Skip to main content

Google Drive

Google Drive Audit Export​

Last verified: 2026-06-30

Intended Setup​

Awthy should use a HaakCo-managed Google OAuth broker with offline access and the least-privilege drive.file scope. Clients should not have to create Google Cloud OAuth applications, client IDs, client secrets, or redirect URIs. Refresh tokens must be encrypted at rest and never shown back to the browser.

The managed broker is Awthy Hub, a Cloudflare Worker service operated by HaakCo. It is not customer-operated infrastructure.

The account flow stays intentionally narrow: sign in to Hub with an email magic link, choose the license/site, copy a short claim code into WordPress, and let WordPress make signed Hub requests for the managed connection. Hub claim codes are short-lived and should never be sent to support after use.

Callback URLs are environment-specific. Production uses Awthy Hub at https://hub.awthy.com with the Google OAuth callback URL https://hub.awthy.com/google-drive/callback; local and staging environments must use their own broker origins and callback URLs.

Current Build Status​

The upload adapter can refresh an access token and upload the package plus manifest. Small files use Google's multipart upload path; files larger than 5 MB use Drive resumable upload sessions.

The legacy client-managed OAuth setup is disabled because it would require each client to configure their own Google Cloud app and callback URL. Google Drive export is wired through Awthy Hub, but it is not ready for broad self-serve enablement until production Hub/Google OAuth configuration is verified and a real Google Drive test-account smoke passes.

Visible connection or callback errors should be handled by localized Awthy plugin UI. Store owners should not be asked to inspect raw Hub JSON responses or copy internal error payloads into support requests.

Production Requirements​

  • Use a dedicated Google Cloud OAuth client for Awthy through the HaakCo-managed authorization broker.
  • Production broker origin: https://hub.awthy.com.
  • Production OAuth callback: https://hub.awthy.com/google-drive/callback.
  • Request drive.file, not broad Drive scopes.
  • Store refresh tokens encrypted.
  • Keep Google OAuth client secrets in the managed broker only, never in customer WordPress settings.
  • Use resumable upload for packages larger than 5 MB.
  • Run a real Google Drive test-account smoke before marketing or enabling this path broadly.
Last updated on